From ae6ee03de2cb7abee8473988b5137da6f86343c8 Mon Sep 17 00:00:00 2001
From: Mohamed Ikbal Belbahri <36099157+mibelbahri@users.noreply.github.com>
Date: Wed, 28 Feb 2024 21:20:56 +0100
Subject: [PATCH] Add https security to cloud-functions-v1 module (#2118)
* Add https security level to cf v1 module
* Update tfdoc.py raw strings for slug var to avoid [SyntaxWarning: invalid escape sequence]
---
modules/cloud-function-v1/README.md | 27 +++++++++++-----------
modules/cloud-function-v1/main.tf | 31 +++++++++++++-------------
modules/cloud-function-v1/variables.tf | 6 +++++
tools/tfdoc.py | 4 ++--
4 files changed, 38 insertions(+), 30 deletions(-)
diff --git a/modules/cloud-function-v1/README.md b/modules/cloud-function-v1/README.md
index 75e6c382..2d52842b 100644
--- a/modules/cloud-function-v1/README.md
+++ b/modules/cloud-function-v1/README.md
@@ -265,24 +265,25 @@ module "cf-http" {
|---|---|:---:|:---:|:---:|
| [bucket_name](variables.tf#L26) | Name of the bucket that will be used for the function code. It will be created with prefix prepended if bucket_config is not null. | string
| ✓ | |
| [bundle_config](variables.tf#L38) | Cloud function source folder and generated zip bundle paths. Output path defaults to '/tmp/bundle.zip' if null. | object({…})
| ✓ | |
-| [name](variables.tf#L97) | Name used for cloud function and associated resources. | string
| ✓ | |
-| [project_id](variables.tf#L112) | Project id used for all resources. | string
| ✓ | |
-| [region](variables.tf#L117) | Region used for all resources. | string
| ✓ | |
+| [name](variables.tf#L103) | Name used for cloud function and associated resources. | string
| ✓ | |
+| [project_id](variables.tf#L118) | Project id used for all resources. | string
| ✓ | |
+| [region](variables.tf#L123) | Region used for all resources. | string
| ✓ | |
| [bucket_config](variables.tf#L17) | Enable and configure auto-created bucket. Set fields to null to use defaults. | object({…})
| | null
|
| [build_worker_pool](variables.tf#L32) | Build worker pool, in projects//locations//workerPools/ format. | string
| | null
|
| [description](variables.tf#L47) | Optional description. | string
| | "Terraform managed."
|
| [environment_variables](variables.tf#L53) | Cloud function environment variables. | map(string)
| | {}
|
| [function_config](variables.tf#L59) | Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout. | object({…})
| | {…}
|
-| [iam](variables.tf#L79) | IAM bindings for topic in {ROLE => [MEMBERS]} format. | map(list(string))
| | {}
|
-| [ingress_settings](variables.tf#L85) | Control traffic that reaches the cloud function. Allowed values are ALLOW_ALL, ALLOW_INTERNAL_AND_GCLB and ALLOW_INTERNAL_ONLY . | string
| | null
|
-| [labels](variables.tf#L91) | Resource labels. | map(string)
| | {}
|
-| [prefix](variables.tf#L102) | Optional prefix used for resource names. | string
| | null
|
-| [secrets](variables.tf#L122) | Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format. | map(object({…}))
| | {}
|
-| [service_account](variables.tf#L134) | Service account email. Unused if service account is auto-created. | string
| | null
|
-| [service_account_create](variables.tf#L140) | Auto-create service account. | bool
| | false
|
-| [trigger_config](variables.tf#L146) | Function trigger configuration. Leave null for HTTP trigger. | object({…})
| | null
|
-| [vpc_connector](variables.tf#L156) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | object({…})
| | null
|
-| [vpc_connector_config](variables.tf#L166) | VPC connector network configuration. Must be provided if new VPC connector is being created. | object({…})
| | null
|
+| [https_security_level](variables.tf#L79) | The security level for the function: Allowed values are SECURE_ALWAYS, SECURE_OPTIONAL. | string
| | null
|
+| [iam](variables.tf#L85) | IAM bindings for topic in {ROLE => [MEMBERS]} format. | map(list(string))
| | {}
|
+| [ingress_settings](variables.tf#L91) | Control traffic that reaches the cloud function. Allowed values are ALLOW_ALL, ALLOW_INTERNAL_AND_GCLB and ALLOW_INTERNAL_ONLY . | string
| | null
|
+| [labels](variables.tf#L97) | Resource labels. | map(string)
| | {}
|
+| [prefix](variables.tf#L108) | Optional prefix used for resource names. | string
| | null
|
+| [secrets](variables.tf#L128) | Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format. | map(object({…}))
| | {}
|
+| [service_account](variables.tf#L140) | Service account email. Unused if service account is auto-created. | string
| | null
|
+| [service_account_create](variables.tf#L146) | Auto-create service account. | bool
| | false
|
+| [trigger_config](variables.tf#L152) | Function trigger configuration. Leave null for HTTP trigger. | object({…})
| | null
|
+| [vpc_connector](variables.tf#L162) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | object({…})
| | null
|
+| [vpc_connector_config](variables.tf#L172) | VPC connector network configuration. Must be provided if new VPC connector is being created. | object({…})
| | null
|
## Outputs
diff --git a/modules/cloud-function-v1/main.tf b/modules/cloud-function-v1/main.tf
index dc274729..d03e1803 100644
--- a/modules/cloud-function-v1/main.tf
+++ b/modules/cloud-function-v1/main.tf
@@ -51,21 +51,22 @@ resource "google_vpc_access_connector" "connector" {
}
resource "google_cloudfunctions_function" "function" {
- project = var.project_id
- region = var.region
- name = "${local.prefix}${var.name}"
- description = var.description
- runtime = var.function_config.runtime
- available_memory_mb = var.function_config.memory_mb
- max_instances = var.function_config.instance_count
- timeout = var.function_config.timeout_seconds
- entry_point = var.function_config.entry_point
- environment_variables = var.environment_variables
- service_account_email = local.service_account_email
- source_archive_bucket = local.bucket
- source_archive_object = google_storage_bucket_object.bundle.name
- labels = var.labels
- trigger_http = var.trigger_config == null ? true : null
+ project = var.project_id
+ region = var.region
+ name = "${local.prefix}${var.name}"
+ description = var.description
+ runtime = var.function_config.runtime
+ available_memory_mb = var.function_config.memory_mb
+ max_instances = var.function_config.instance_count
+ timeout = var.function_config.timeout_seconds
+ entry_point = var.function_config.entry_point
+ environment_variables = var.environment_variables
+ service_account_email = local.service_account_email
+ source_archive_bucket = local.bucket
+ source_archive_object = google_storage_bucket_object.bundle.name
+ labels = var.labels
+ trigger_http = var.trigger_config == null ? true : null
+ https_trigger_security_level = var.https_security_level == null ? "SECURE_ALWAYS" : var.https_security_level
ingress_settings = var.ingress_settings
build_worker_pool = var.build_worker_pool
diff --git a/modules/cloud-function-v1/variables.tf b/modules/cloud-function-v1/variables.tf
index e3e0139c..567a8c7a 100644
--- a/modules/cloud-function-v1/variables.tf
+++ b/modules/cloud-function-v1/variables.tf
@@ -76,6 +76,12 @@ variable "function_config" {
}
}
+variable "https_security_level" {
+ description = "The security level for the function: Allowed values are SECURE_ALWAYS, SECURE_OPTIONAL."
+ type = string
+ default = null
+}
+
variable "iam" {
description = "IAM bindings for topic in {ROLE => [MEMBERS]} format."
type = map(list(string))
diff --git a/tools/tfdoc.py b/tools/tfdoc.py
index d41a35a7..79df4291 100755
--- a/tools/tfdoc.py
+++ b/tools/tfdoc.py
@@ -366,8 +366,8 @@ def create_toc(readme):
for h in headings[1:]:
title = h.children[0].children
slug = title.lower().strip()
- slug = re.sub('[^\w\s-]', '', slug)
- slug = re.sub('[-\s]+', '-', slug)
+ slug = re.sub(r'[^\w\s-]', '', slug)
+ slug = re.sub(r'[-\s]+', '-', slug)
link = f'- [{title}](#{slug})'
indent = ' ' * (h.level - 2)
lines.append(f'{indent}{link}')